A comprehensive overview of software assurance methodologies applied to a Public Key Directory project for Fediverse E2EE. The author details their multi-layered testing approach including specification-first development, mutation testing (targeting 90%+ MSI), fuzz testing, static analysis with Psalm/PHPStan/Semgrep, property-based testing with Eris, and integration testing. Future plans include formal verification using ProVerif, requirements traceability with Duvet, and isochronic verification for constant-time guarantees. The piece emphasizes that trustworthiness comes from rigorous methodology rather than expensive audits, achieving high assurance through automated testing that cannot be gamed like traditional code coverage metrics.
Table of contents
Cryptography Audits and Other Thought-Terminating ClichésTowards Furry-Grade AssuranceWhat Is Left To DoClosing ThoughtsSort: